Loading patent…
AssigneeInternational Business Machines Corporation
InventorsWilliam F. Ehrsam, Robert C. Elander, Lloyd L. Hollis, Richard E. Lennon, Stephen M. Matyas, Carl H. W. Meyer, Jonathan Oseas, Walter L. Tuchman
Estimating the term…
A communication security system for data transmissions between different domains of a multiple domain communication network where each domain includes a host system and its associated resources of programs and communication terminals. The host systems and communication terminals include data security devices each having a master key which permits a variety of cryptographic operations to be performed. When a host system in one domain wishes to communicate with a host system in another domain, a common session key is established at both host systems to permit cryptographic operations to be performed. This is accomplished by using a mutually agreed upon cross-domain key known by both host systems and does not require each host system to reveal its master key to the other host system. The cross domain key is enciphered under a key encrypting key designated as the sending cross domain key at the sending host system and under a different key encrypting key designated as the receiving cross domain key at the receiving host system. The sending host system creates an enciphered session key and together with the sending cross-domain key performs a transformation function to reencipher the session key under the sending cross domain key for transmission to the receiving host system. At the receiving host system, the receiving host system using the receiving cross-domain key and the received session key, performs a transformation function to reencipher the received session key fron encipherment under the sending cross domain key to encipherment under the receiving host system master key. With the common session key now available in usable form at both host systems, a communication session is established and cryptographic operations can proceed between the two host systems.
In a multiple domain data communication network providing communication security for data communication sessions between a first host system in one domain having cryptographic apparatus provided with a first master key and a second host system in another domain having cryptographic apparatus provided with a second master key, an arrangement for establishing a common operational key for cryptographic operations between said host systems comprising:
In a multiple domain data communication network providing communication security for data communication sessions between a first host system in one domain having cryptographic apparatus provided with a first master key and a second host system in another domain having cryptograhic apparatus provided with a second master key, an arrangement for establishing a common operational key for cryptographic operations between said host systems comprising:
In a multiple domain data communication network providing communication security for communication sessions between a first host system in one domain having cryptographic apparatus provided with a first master key and a second host system in another domain having cryptographic apparatus provided with a second master key where the cryptographic apparatus of each host system provides a cross domain key for cryptographic cross domain communication wit the other host system, an arrangement in said first host cryptographic apparatus for protecting the cross domain key provided by said first host system cryptographic apparatus comprising:
In a multiple domain data communication network providing communication security for data communication sessions between a terminal associated with a first host system in one domain and an application program associated with a second host system in another domain where said terminal, said first host system and said second host system having cryptographic apparatus provided with a terminal master key, a first master key and a second master key, respectively, an arrangement for establishing a cryptographic cross domain communication session between said terminal and said application program comprising:
In a multiple domain data communication network providing communication security for data communication sessions between a first application program associated with a first host system in one domain and a second application program associated with a second host system in another domain where said first host system has cryptographic apparatus provided with a first master key and an application key associated with said first application program and said second host system has cryptographic apparatus provided with a second master key, an arrangement for establishing a cryptographic cross domain communication session between said application programs comprising:
In a multiple domain data communication network providing communication security for data communication sessions between a first host system in one domain having cryptographic apparatus provided with a first master key and a second host system in another domain having cryptographic apparatus provided with a second master key, the method of establishing a common operational key for cryptographic operations between said host systems comprising the steps of:
In a multiple domain data communication network providing communication security for data communication sessions between a first host system in one domain having cryptographic apparatus provided with a first master key and a second host system in another domain having cryptographic apparatus provided with a second master key, the method for establishing a common operational key for cryptographic operations between said host systems comprising the steps of:
In a multiple domain data communication network providing communication security for data communication sessions between a terminal associated with a first host system in one domain and an application program associated with a second host system in another domain where said terminal, said first host system and said second host system have cryptographic apparatus provided with a terminal master key, a first master key and a second master key, respectively, the method of establishing a cryptographic cross domain communication session between said terminal and said application program comprising the steps of:
In a multiple domain data communication network providing communication security for data communication sessions between a first application program associated with a first host system in one domain and a second application program associated with a second host system in another domain where said first host system has cryptographic apparatus provided with a first master key and an application key associated with said first application program and said second host system has cryptographic apparatus provided with a second master key, the method of establishing a cryptographic cross domain communication session between said application programs comprising the steps of:
In a multiple domain data communication network providing communication security for data communication sessions between a host system in one domain having cryptographic apparatus provided with multiple keys and a host system in another domain having cryptographic apparatus provided with multiple keys, an arrangement for communicating a cryptographic operational key in protected form provided by one of said host systems to the other of said host systems without revealing the multiple keys of either of said host systems to the other of said host systems comprising:
In a multiple domain data communication network providing communication security for data communication sessions between a host system in one domain having cryptographic apparatus provided with multiple keys and a host system in another domain having cryptographic apparatus provided with multiple keys, an arrangement for communicating a cryptographic operational key in protected form provided by one of said host systems to the other of said host systems without revealing the multiple keys of either of said host systems to the other of said host systems comprising:
In a multiple domain data communication network providing communication security for data communication sessions between a host system in one domain having cryptographic apparatus providing with multiple keys and a host system in another domain having cryptographic apparatus provided with multiple keys where each host system has a logical unit associated therewith and a logical unit communication key, an arrangement for communicating a cryptographic operational key in protected form provided by one of said host systems to the logical unit associated therewith via the other of said host systems without revealing the multiple keys of either of said host systems to the other of said host systems comprising:
In a multiple domain data communication network providing communication security for data communication sessions between a host system in one domain having cryptographic apparatus provided with multiple keys and a host system in another domain having cryptographic apparatus provided with multiple keys, the method of communicating a cryptographic operational key in protected form providing by one of said host systems to the other of said host systems without revealing the multiple keys of either of said host systems to the other of said host systems comprising the steps of:
In a multiple domain data communication network providing communication security for data communication sessions between a host system in one domain having cryptographic apparatus provided with multiple keys and a host system in another domain having cryptographic apparatus provided with multiple keys, the method of communicating a cryptographic operational key in protected form provided by one of said host systems to the other of said host systems without revealing the multiple keys of either of said host systems to the other of said host systems comprising:
In a multiple domain data communication network providing communication security for data communication sessions between a host system in one domain having cryptographic apparatus provided with multiple keys and a host system in another domain having cryptographic apparatus provided with multiple keys where each host system has a logical unit associated therewith and a logical unit communication key, the method of communicating a cryptographic operational key in protected form provided by one of said host systems to the logical unit associated therewith via the other of said host systems without revealing the multiple keys of either of said host systems to the other of said host systems comprising the steps of:
Dependencies are inferred from the claim text.